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- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). tn no event, however, may a reply be timely filed 
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2a)D This action is FINAL. 2b)S This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1 935 CD. 1 1 , 453 O.G. 21 3. 

Disposition of Claims 

4) E3 Claim(s) 1-27 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) S Claim(s) 7-27 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) 13 The drawing(s) filed on 26 July 2001 is/are: a)[3 accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

11) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 
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application from the International Bureau (PCT Rule 17.2(a)). 
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DETAILED ACTION 
Claim Rejections - 35 USC §102 

1 . The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 2 1(2) of such treaty in the English language. 

2. Claims 1-6 and 8-16 are rejected under 35 U.S.C. 102(e) as being anticipated by Levi et 
al. (US 6,804,778), hereafter is referred as Levi. 

Regarding claim 1, Levi teaches a Method and Apparatus For Data Quality Assurance. 
Levi's invention teaches a network bridge (32, Fig. 1, an output monitor, see col. 5, lines 31- 
34, an output monitor is integrated with a bridge) having a malware scanner (32, Fig. 1, see 
col. 2, lines 1-8 and col. 6, lines 40-46, the output monitor scans for corrupted files which 
could contain viruses). 

Regarding claims 2 and 12, Levi teaches all limitations set forth in the rejections of 
claims 1 and 11. Levi also teaches a network bridge comprising: a data packet analyser (54, 
Fig. 3) operable to identify data packets received by said network bridge (32, Fig. 1, the output 
monitor) at least a portion of which are to be passed to said malware scanner for scanning (see 
col. 11, lines 57-63). 



Application/Control Number: 09/9 1 2,305 Page 3 

Art Unit: 2665 

Regarding claims 3 and 13, Levi teaches all limitations set forth in the rejections of 
claims 2 and 12. Levi also teaches wherein said data packet analyser identifies data packets 
having a predetermined network layer protocol {TCP/IP layer) as to be passed to said malware 
scanner for scanning (see col. 6, line 65 - col. 7, line 10, the exit control is implemented at the 
TCP/IP stack). 

Regarding claims 4 and 14, Levi teaches all limitations set forth in the rejections of 
claims 3 and 14. Levi also teaches wherein said predetermined network layer protocol is one or 
more of: TCP/IP; IPX; SNA; and Appletalk (TCP/IP layer, see col. 6, line 65 - col. 7, line 10). 

Regarding claims 5 and 15, Levi teaches all limitations set forth in the rejections of 
claims 2 and 12. Levi also teaches wherein said data packet analyser identifies data packets 
having a predetermined application layer protocol as to be passed to said malware scanner for 
scanning (see col. 5, lines 1-11, col. 6, line 65 - col. 7, line 10, the output monitor scans for 
viruses at application layer). 

Regarding claims 6 and 16, Levi teaches all limitations set forth in the rejections of 
claims 5 and 15. Levi also teaches wherein said predetermined application layer protocol is one 
or more of: SMTP; FTP; HTTP; SMB; and NFS (see col. 2, lines 18-37, col. 3, lines 56-64 and 
col. 10, lines 26-41, e-mail protocol, FTP, HTTP). 
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Regarding claim 8, Levi teaches all limitations set forth in the rejection of claim 1. Levi 
also teaches wherein said malware scanner is operable to scan for one or more of: computer 
viruses; Trojans; worms; banned computer programs; and banned words within e-mail messages 
(see col. 5, lines 1-11, col. 6, line 65 - col. 7, line 10). 

Regarding claim 9, Levi teaches all limitations set forth in the rejection of claim 1. Levi 
also teaches wherein data that has been scanned by said malware scanner is forwarded to its 
intended recipient (58, Fig. 3, see col. 1 1, lines 57-64, after the data is scanned and free of 
viruses or is ensured that the data has not been corrupted, the data is transmitted onto its 
intended client). 

Regarding claim 10, Levi teaches all limitations set forth in the rejection of claim 1. 
Levi also teaches wherein said malware scanner is formed of one or more of: a software based 
malware scanner; and a hardware based malware scanner (see col. 7, lines 1-10). 

Regarding claim 11, Levi teaches a Method and Apparatus For Data Quality Assurance. 

Levi's invention teaches a network bridge (32, Fig. 1, an output monitor, see col. 5, lines 31- 

34, an output monitor is integrated with a bridge) comprising: 

means for intercepting at least one data packet (52, Fig. 3, see col. 11, lines 57-64), 
means for forwarding at least a portion of said at least one data packets to a malware 

scanner for scanning (see col. 1 1, lines 57-64), and 
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means for forwarding data from said at least one data packets after scanning to an 
intended recipient (58, Fig. 3, see col. 1 1, lines 57-64). 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

4. This application currently names joint inventors. In considering patentability of the 
claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the various 
claims was commonly owned at the time any inventions covered therein were made absent any 
evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out 
the inventor and invention dates of each claim that was not commonly owned at the time a later 
invention was made in order for the examiner to consider the applicability of 35 U.S.C. 103(c) 
and potential 35 U.S.C. 102(e), (f) or (g) prior art under 35 U.S.C. 103(a). 

5. Claims 7, 17-27 are rejected under 35 U.S.C. 103(a) as being unpatentable over Levi in 
view of Hershey et al. (US 5,414,833) hereafter is referred as Hershey. 

Regarding claim 7, Levi teaches all limitations set forth in the rejection of claim 1. 
Levi does not expressly teach wherein said malware scanner is operable to concatenate 
portions of a data file from a plurality of data packets to form a data file to be scanned. 
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Hershey teaches a malware scanner (130, Fig. 1, a Finite State Machine) is operable to 
concatenate portions (stream a portion / concatenation X-bit to be scanned for viruses) of a 
data file (a scanning page of X-bit in the computer memories) from a plurality of data packets 
to form a data file to be scanned (see col. 9, line 62 - col. 10, line 10 and col. 10, lines 45-59). 

It would have been obvious to one of ordinary skill in the art, at the time invention was 
made/to employ the adaptive, active viruses monitoring as taught by Hershey into Levi to 
arrive the claimed invention as specified in claim 7. 

The suggestion/motivation for doing so would have been to provide an efficient, fast data 
processing in real-time mode to cut down the delay which introduced in most viruses scanner 
system in order to improve/ensure the reliability of voice/data network communication (see col. 
2, lines 22-34 and col. 6, lines 29-44). 

Regarding claim 17, Levi teaches a Method and Apparatus For Data Quality Assurance. 
Levi's invention teaches a malware scanner (52, Fig. 3) in combination with a network bridge 
(see col. 5, lines 3 1-34, an output monitor is integrated with a bridge) comprising: means for 
receiving at least a portion of at least one data packet intercepted by a network bridge (32, Fig. 
1, see col. 11, lines 57-64, receiving data packets to be scanned) and to forward said data file 
after scanning to its intended recipients via said network bridge (see col 1 1, lines 57-64). 

Levi does not expressly teach means for concatenating for said at least one data packets 
into a data file to be scanned. 
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Hershey teaches a malware scanner (130, Fig. 1, a Finite State Machine) comprises 
means for concatenating said at least one data packets into a data file to be scanned (see col. 9, 
line 62 - col. 10, line 10 and col. 10, lines 45-59). 

It would have been obvious to one of ordinary skill in the art, at the time invention was 
made, to employ the adaptive, active viruses monitoring as taught by Hershey into Levi to 
arrive the claimed invention as specified in claim 17. 

The suggestion/motivation for doing so would have been to provide an efficient, fast data 
processing in real-time mode to cut down the delay which introduced in most viruses scanner 
system in order to improve/ensure the reliability of voice/data network communication (see col. 
2, lines 22-34 and col. 6, lines 29-44). 

Regarding claim 18 and 26, Levi and Hershey teach all limitations set forth in the 
rejections of claims 17 and 20. Levi also teaches wherein said malware scanner is operable to 
scan for one or more of: computer viruses; Trojans; worms; banned computer programs; and 
banned words within e-mail messages (see col 5, lines 1-11, col. 6, line 65 - col. 7, line 10). 

Regarding claims 19 and 27, Levi and Hershey teach all limitations set forth in the 
rejection of claims 18 and 26. Levi also teaches wherein said malware scanner is formed of one 
or more of: a software based malware scanner; and a hardware based malware scanner (see col. 
7, lines 1-10). 
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Regarding claim 20, Levi teaches a Method and Apparatus For Data Quality Assurance. 
Levi's invention teaches a method of malware scanning comprising the steps of: receiving data 
packets at a network bridge (32, Fig. 1, see col. 5, lines 31-34, an output monitor integrated in 
a network bridge that scans for viruses or corrupted files, and col. 11, line 57-64, receiving 
data packets to be scanned); sending at least a portion of said data packets from said network 
bridge to a malware scanner (see col. 11, lines 57-64); scanning said data file with said malware 
scanner (see col. 11, lines 57-64); and forwarding said data file after scanning via said network 
bridge to its intended recipient (see col. 11, lines 57-64). 

Levi does not expressly teach concatenating data received by said malware scanner to 
form a data file to be scanned. 

Hershey teaches a malware scanner (130, Fig. 1, a Finite State Machine) is operated to 
concatenate data received by said malware scanner {stream a portion / concatenation X-bit to 
be scanned for viruses) to form a data file to be scanned (see col. 9, line 62 - col. 10, line 10 
and col. 10, lines 45-59). 

It would have been obvious to one of ordinary skill in the art, at the time invention was 
made, to employ the adaptive, active viruses monitoring as taught by Hershey into Levi to 
arrive the claimed invention as specified in claim 20. 

The suggestion/motivation for doing so would have been to provide an efficient, fast data 
processing in real-time mode to cut down the delay which introduced in most viruses scanner 
system in order to improve/ensure the reliability of voice/data network communication (see col. 
2, lines 22-34 and col. 6, lines 29-44). 
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Regarding claim 21, Levi and Hershey teach all limitations set forth in the rejection of 
claim 20. Levi also teaches a network bridge comprising: a data packet analyser (54, Fig. 3) 
operable to identify data packets received by said network bridge (32, Fig. 1, the output 
monitor) at least a portion of which are to be passed to said malware scanner for scanning (see 
col. 11, lines 57-63). 

Regarding claim 22, Levi and Hershey teach all limitations set forth in the rejection of 
claim 21 . Levi also teaches wherein said data packet analyser identifies data packets having a 
predetermined network layer protocol {TCP/IP layer) as to be passed to said malware scanner 
for scanning (see col. 6, line 65 - col. 7, line 10, the exit control is implemented at the TCP/IP 
stack). 

Regarding claim 23, Levi and Hershey teach all limitations set forth in the rejection of 
claim 22. Levi also teaches wherein said predetermined network layer protocol is one or more 
of: TCP/IP; IPX; SNA; and Appletalk (TCP/IP layer, see col. 6, line 65 - col. 7, line 10). 

Regarding claim 24, Levi and Hershey teach all limitations set forth in the rejection of 
claim 21 . Levi also teaches wherein said data packet analyser identifies data packets having a 
predetermined application layer protocol as to be passed to said malware scanner for scanning 
(see col. 5, lines 1-11, col. 6, line 65 - col. 7, line 10, the output monitor scans for viruses at 
application layer). 
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Regarding claim 25, Levi and Hershey teach all limitations set forth in the rejection of 
claim 24. Levi also teaches wherein said predetermined application layer protocol is one or 
more of: SMTP; FTP; HTTP; SMB; and NFS (see col. 2, lines 18-37, col. 3, lines 56-64 and 
col. 10, lines 26-41, e-mail protocol, FTP, HTTP), 

Response to Arguments 

6. Applicant's arguments with respect to claims 1-27 have been considered but are moot in 
view of the new ground(s) of rejection. 

Conclusion 

7. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. Antur et al (US 6,212,558); Kirby et al (US 5,828,846); Shannon (US 6,233,618); 
Shwed (US 5,606,668); Pickett et al (US 6,356,554); Cooper et al (US 2004/0039942); Ji et al 
(US 5,623,600); Esbensen (US 5,796,942); Donaldson (US 6,321,267) are cited to show a 
system and method of Malware Scanning Using a Network Bridge, which is considered pertinent 
to the claimed invention. 

8. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Lee Khuong whose telephone number is 571-272-3 157. The 
examiner can normally be reached on 9AM - 5PM. 

9. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Huy Vu can be reached on 571-272-3 155. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 
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10. Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 





Lee T. Khuong 
Examiner 
Art Unit 2665 



HUY D.VU 
SUPERVISORY PATENT EXAMINER 
TECHNOLOGY CENTER 2600 



